- 18 Nov 2026 UK Have your directors and PSCs verified with Companies House?
- 1 Dec 2026 AU Will your onboarding accept private-sector Digital IDs?
- 10 Dec 2026 AU Does your privacy policy explain your automated KYC decisions?
- End 2026 EU Is your ID verification ready for EUDI Wallets?
- 1 Jan 2027 US Can your age checks keep up state by state?
- 1 Apr 2027 JP Is your eKYC ready for the IC-chip mandate?
- 10 Jul 2027 EU Is your CDD flow ready for the AMLR?
- 1 Jan 2028 US Are your adviser clients ready for FinCEN’s AML rule?
- 31 Mar 2029 AU Is your initial CDD on the new AUSTRAC model?
- Now AU Tranche 2 is live. Is your AML/CTF program running?
The Money Laundering Regulations: what UK firms must do, and what changed in 2026
The Money Laundering Regulations 2017 set the customer due diligence, enhanced due diligence and record keeping rules for the UK regulated sector. SI 2026/621 changed thresholds and the high-risk country test from 30 June 2026.
- The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017) are the core UK anti-money laundering rulebook for the regulated sector.
- Since 30 June 2026, CDD thresholds are in sterling: an occasional transaction of £12,000 or more, or a transfer of funds over £800, triggers CDD.
- Since 30 June 2026, enhanced due diligence is triggered by a FATF call for action country, meaning a country on the FATF list of High-Risk Jurisdictions subject to a Call for Action.
- Records of CDD and transactions must be kept for five years from the end of the business relationship or the completed occasional transaction.
- The Government has decided the FCA will become the AML supervisor for legal, accountancy and trust and company service providers; the FCA says nothing changes for firms yet.
What it is
The Money Laundering Regulations 2017 (SI 2017/692) require businesses in the regulated sector to assess their money laundering and terrorist financing risk, know their customers, and keep evidence of what they did. They sit alongside the Proceeds of Crime Act 2002 and the Terrorism Act 2000, which hold the reporting offences.
The regulations are risk-based. A firm writes its own risk assessment (reg 18) and its own policies, controls and procedures (reg 19), then applies customer due diligence (regs 27 and 28) at a level that matches the risk. Simplified due diligence (reg 37) is allowed for low risk. Enhanced due diligence (reg 33) is required for higher risk, and for politically exposed persons (reg 35).
The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621) were made on 9 June 2026. Most of it came into force on 30 June 2026. Cryptoasset provisions follow on 1 February 2027 and 25 October 2027.
Who it applies to
The regulations apply to "relevant persons" acting in the course of business in the UK (reg 8). For professional firms, coverage depends on the services you provide, not your job title.
- Auditors, insolvency practitioners, external accountants and tax advisers (reg 11)
- Independent legal professionals taking part in financial or property transactions, including conveyancing (reg 12)
- Trust or company service providers, now including anyone selling an off-the-shelf company (reg 12, as amended)
- Estate agents, and letting agents for monthly rents of £10,000 or more
- Credit and financial institutions, cryptoasset exchange and custodian wallet providers
- High value dealers taking cash of £10,000 or more, art market participants, and casinos
Every relevant person must have an AML supervisor. Accountants and lawyers are usually supervised by their professional body. HMRC supervises businesses with no professional body supervisor, and the FCA supervises financial and cryptoasset firms. See HMRC AML supervision.
What you have to do
These are the duties that apply to most professional firms. Your supervisor's guidance sets out how it expects them to be met, and your own risk assessment decides the depth.
- Assess risk and set policies
Write a firm-wide risk assessment (reg 18) and keep policies, controls and procedures that match it (reg 19). Train relevant staff (reg 24) and keep internal controls in place (reg 21).
One-off, then review - Identify and verify the customer
Apply CDD when you start a business relationship, for occasional transactions at or above the thresholds, when you suspect money laundering, or when you doubt earlier ID (reg 27). Verify identity from a reliable, independent source (reg 28).
- Identify beneficial owners and the purpose of the relationship
For companies, trusts and other structures, find out who owns and controls the customer and take reasonable steps to verify them, and understand the intended nature of the business relationship (reg 28).
- Screen and apply enhanced due diligence
Check whether a customer or beneficial owner is a politically exposed person (reg 35). Apply EDD for higher risk, including any relationship or transaction involving a person established in a FATF call for action country (reg 33, as amended).
- Score the risk of each client
Assess each customer's risk using the factors in your risk assessment, and record why you chose simplified, standard or enhanced measures.
- Monitor the relationship
Conduct ongoing monitoring: scrutinise transactions and keep CDD documents and information up to date (reg 28).
- Keep records
Keep copies of CDD documents and records of transactions for five years from the end of the relationship or the completed occasional transaction, and no longer than 10 years for transaction records unless an exception applies (reg 40).
Ongoing
What firms get wrong
The 2026 amendments changed numbers and definitions that sit inside many firms' procedures and software settings. These are the common slips.
Since 30 June 2026, regulation 27(2) uses £12,000 for occasional transactions, and transfers of funds over £800 trigger CDD under regulation 27(1)(b). Some of the new figures are lower than a straight conversion because a 1:1 change would have fallen short of FATF standards.
SI 2026/621 replaced "high-risk third country" in regulation 33 with "FATF call for action country", defined by the FATF's list of High-Risk Jurisdictions subject to a Call for Action, as it has effect from time to time. Your country list should follow that FATF list.
The Government decided in October 2025 that the FCA will supervise legal, accountancy and trust and company service providers. The FCA says nothing changes immediately and firms should keep working with their current supervisor.
From 30 June 2026, new regulation 29 provisions apply to pooled client accounts opened on or after commencement. The firm must understand the account's purpose and assess and manage its risk, and the account holder must keep records and provide beneficial owner information on request.
HM Treasury and DSIT guidance of 26 February 2026 says a digital verification service that is certified under the UK digital identity trust framework and listed on the government's DVS register can meet the identity verification part of regulation 28. The government has said services that are not on the register cannot reliably be treated as suitable. Your policies should say which method you rely on and why.
What happens when
- In force
Money Laundering Regulations 2017 come into force Source
- In force
SI 2026/621 made Source
- In force
Main amendments in force: sterling thresholds, FATF call for action EDD trigger, pooled client accounts, off-the-shelf company sales, trust registration changes Source
- Commencing
EDD for cryptoasset correspondent relationships (new reg 34A) Source
- Commencing
Deadline for trusts that acquired UK land before 6 October 2020 and still hold it to register Source
- Commencing
Change in control regime for registered cryptoasset businesses (Schedule 6B) Source
- Not yet setProposed
FCA becomes AML supervisor for legal, accountancy and TCSP firms; the FCA does not expect to begin before autumn 2028, subject to legislation Source
Not yet confirmed. We will update this when the date is set.
Related guides
Questions people ask
What are the Money Laundering Regulations 2017?
They are the UK's main anti-money laundering regulations (SI 2017/692). They require regulated businesses to assess risk, carry out customer due diligence, apply enhanced checks for higher risk, train staff and keep records, under the oversight of an AML supervisor.
What changed in the Money Laundering Regulations in 2026?
SI 2026/621, mostly in force from 30 June 2026, moved thresholds from euros to sterling, replaced the high-risk third country test with FATF call for action countries, added rules for pooled client accounts, brought off-the-shelf company sales into TCSP scope and changed trust registration.
Who has to comply with the Money Laundering Regulations?
Relevant persons under regulation 8, including accountants, tax advisers, auditors, insolvency practitioners, lawyers in financial and property transactions, TCSPs, estate and letting agents, financial and cryptoasset firms, high value dealers, art market participants and casinos.
When is enhanced due diligence required?
For any case the firm assesses as higher risk, for PEPs and their family and close associates, for a relationship or transaction involving a FATF call for action country, where a customer has given false or stolen ID and the firm proposes to continue, and for transactions that are unusually complex or unusually large given their nature, follow an unusual pattern, or have no apparent economic or legal purpose (reg 33). See enhanced due diligence for PEPs.
How long must AML records be kept in the UK?
Five years from when the firm knows, or has reasonable grounds to believe, that the occasional transaction is complete or the business relationship has ended (reg 40). See the AML customer due diligence checklist.
Is the FCA taking over AML supervision?
For legal, accountancy and TCSP firms, yes, by Government decision. No start date is fixed. The FCA's published plan does not expect it to begin taking on supervision before autumn 2028, and it depends on legislation. See HMRC AML supervision.
Primary sources
Checked 5 Nov 2026. We review this page every 90 days and when the rules change.
- legislation.gov.uk, The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017
- legislation.gov.uk, MLR 2017 regulation 27 (as amended from 30 June 2026)
- legislation.gov.uk, MLR 2017 regulation 40, Record-keeping
- legislation.gov.uk, The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621)
- legislation.gov.uk, SI 2026/621 regulation 19 (amendment of regulation 33)
- FCA, AML supervisory reform
- HM Treasury and DSIT, Using digital identities with the Money Laundering Regulations (26 Feb 2026)
Where StackGo fits
The regulations leave the method to each firm. IdentityCheck is one way to run the client-facing CDD steps and keep the evidence in one place. Other approaches exist, including doing this manually, and this page is not an argument that you need software.
- Identity verification with a photo of a government ID document plus a live selfie with liveness, covering 12,500 document types from 230+ countries and territories
- Onboarding forms, including multi-entity forms that collect each person and entity on a company or trust structure
- PEP, sanctions and adverse media screening, with ongoing monitoring of screened clients
- Risk assessment forms with scoring and enhanced due diligence steps, which a firm can set up to reflect its own country list and thresholds
- Integrations with Xero Practice Manager, Xero, Karbon and HubSpot
- It does not lodge suspicious activity reports or any return with a supervisor
- It does not do transaction monitoring
- It does not write your firm-wide risk assessment or give legal advice
- It does not supply UK beneficial ownership reports; the beneficial ownership report add-on is Australia only
- It is not certified under the UK digital identity trust framework or listed on the government's DVS register
Ready to make onboarding minutes, not hours?
Start free and run your first check today, or book a demo and we will walk you through it.